Stormshield attributes Trigram with high confidence to North Korea and assesses it as an evolved continuation of the UNK_DeadDrop cluster, with infrastructure and operator identifiers overlapping Kimsuky reporting. The campaign impersonates about 50 AI, blockchain, software, and logistics brands and uses fake recruitment, conference, and parcel-tracking portals, trojanized repositories, and a compromised npm component to induce ClickFix-style execution. Cross-platform droppers deploy a Node.js infostealer that targets credentials, cryptocurrency wallets, sensitive files, and system data. A centralized back office automates GitHub-based targeting, multi-provider phishing delivery, victim tracking, data export, and possible wallet operations.